Kyverno not excluding itself from its webhooks may completly block the cluster

Summary

Kyverno's namespace is not excluded from its webhooks configuration.

If, for some reason, kyverno's admission controller goes down, it won't be able to create new pods since it will try to contact itself.

Steps to reproduce

Force kill all kyverno's admission controller pods, they won't be able to come back up.

Assignee Loading
Time tracking Loading